3 ms·

It would be nice if this generator also added options for WPA3 and (disabling) MAC randomisation. Plus generating a per-SSID encrypted DNS (DoH/DoT) configurati

It would be nice if this generator also added options for WPA3 and (disabling) MAC randomisation. Plus generating a per-SSID encrypted DNS (DoH/DoT) configuration, those profiles are actually tedious to assemble.

WirelessGigabit 3y ago
Something I discovered later on is that the MAC doesn't change for a saved SSID. It always uses the same. So there's a mapping that is like SSID -> MAC. They can get reset. But I stopped turning it off on my phone.
- iimblack 3y ago
  Hmm I definitely see my family phones get new MAC addresses from time to time. Maybe the cadence at which they refresh is just irregular?
  - WirelessGigabit 3y ago
    I believe an iOS update triggers it.
    - iimblack 3y ago
      > Starting with iOS 14, iPadOS 14, and watchOS 7, your device improves privacy by using a different MAC address for each Wi-Fi network. This unique MAC address is your device's private Wi-Fi address, which it uses for that network only. In some cases, your device will change its private Wi-Fi address: If you erase all content and settings or reset network settings on the device, your device uses a different private address the next time it connects to that network. Starting with iOS 15, iPadOS 15, and watchOS 8, if your device hasn’t joined the network in 6 weeks, it uses a different private address the next time it connects to that network. And if you make your device forget the network, it will also forget the private address it used with that network, unless it has been less than 2 weeks since the last time it was made to forget that network. https://support.apple.com/en-us/102509 https://support.apple.com/en-us/102509
- radicality 3y ago
  One thing that's bugging me currently in iOS is that I constantly see a "Privacy Warning" text in the wifi section because I turned of 'Private Wifi Address' since I'm on my own home network.
  - lgats 3y ago
    the purpose of this feature is primarily to encrypt unencrypted (http) traffic to stop both MITM &packet inspection by network admins (and compromised routers) as well as to prevent snooping by any ISP. Despite being on your home network, ISP snooping can still take place-- thus the privacy warning.
    - radicality 3y ago
      Is it? Afaik the _only_ thing that “Private WiFi Address” toggle changes is MAC randomization, so it uses a random MAC instead of the actual device MAC. Which is not what I want on my home network, I want the real address for firewall rules etc.
spr-alex 3y ago
Unfortunately this is also an issue with the QR Code format which is underspecified, and this extends to a bug we've been begrudgingly waiting for apple to fix here. The QR Code format is something like this ``` type = 'WPA' return `WIFI:S:${_ssid};P:${password};T:${type};${hidden};` ``` So the long standing bug (feedback id 9991042) we have filed with Apple is about a downgrade issue with QR Codes. If an iOS devices connects with a QR Code it will successfully connect with WPA3. But when the device goes to reconnect it has saved the SSID as a WPA2 network only and will incorrectly only authenticate with WPA2. This is very unfortunate because the zero-knowledge aspect of dragonfly in wpa3 is a huge step forward for wifi security. Although I guess it's all still resting on AES CTR at the end of the day :-)
- Avamander 3y ago
  I'm pretty sure iOS also doesn't support GCM as the group cipher, so these downgrades are not all that uncommon with iOS unfortunately. Hopefully they'll improve it in the future though.

WirelessGigabit 3y ago

Something I discovered later on is that the MAC doesn't change for a saved SSID. It always uses the same. So there's a mapping that is like SSID -> MAC. They can get reset. But I stopped turning it off on my phone.

iimblack 3y ago
Hmm I definitely see my family phones get new MAC addresses from time to time. Maybe the cadence at which they refresh is just irregular?
- WirelessGigabit 3y ago
  I believe an iOS update triggers it.
  - iimblack 3y ago
    > Starting with iOS 14, iPadOS 14, and watchOS 7, your device improves privacy by using a different MAC address for each Wi-Fi network. This unique MAC address is your device's private Wi-Fi address, which it uses for that network only. In some cases, your device will change its private Wi-Fi address: If you erase all content and settings or reset network settings on the device, your device uses a different private address the next time it connects to that network. Starting with iOS 15, iPadOS 15, and watchOS 8, if your device hasn’t joined the network in 6 weeks, it uses a different private address the next time it connects to that network. And if you make your device forget the network, it will also forget the private address it used with that network, unless it has been less than 2 weeks since the last time it was made to forget that network. https://support.apple.com/en-us/102509 https://support.apple.com/en-us/102509
radicality 3y ago
One thing that's bugging me currently in iOS is that I constantly see a "Privacy Warning" text in the wifi section because I turned of 'Private Wifi Address' since I'm on my own home network.
- lgats 3y ago
  the purpose of this feature is primarily to encrypt unencrypted (http) traffic to stop both MITM &packet inspection by network admins (and compromised routers) as well as to prevent snooping by any ISP. Despite being on your home network, ISP snooping can still take place-- thus the privacy warning.
  - radicality 3y ago
    Is it? Afaik the _only_ thing that “Private WiFi Address” toggle changes is MAC randomization, so it uses a random MAC instead of the actual device MAC. Which is not what I want on my home network, I want the real address for firewall rules etc.

spr-alex 3y ago

Unfortunately this is also an issue with the QR Code format which is underspecified, and this extends to a bug we've been begrudgingly waiting for apple to fix here. The QR Code format is something like this ``` type = 'WPA' return `WIFI:S:${_ssid};P:${password};T:${type};${hidden};` ``` So the long standing bug (feedback id 9991042) we have filed with Apple is about a downgrade issue with QR Codes. If an iOS devices connects with a QR Code it will successfully connect with WPA3. But when the device goes to reconnect it has saved the SSID as a WPA2 network only and will incorrectly only authenticate with WPA2. This is very unfortunate because the zero-knowledge aspect of dragonfly in wpa3 is a huge step forward for wifi security. Although I guess it's all still resting on AES CTR at the end of the day :-)

Avamander 3y ago
I'm pretty sure iOS also doesn't support GCM as the group cipher, so these downgrades are not all that uncommon with iOS unfortunately. Hopefully they'll improve it in the future though.